Calculate an HMAC

An HMAC (keyed-hash message authentication code) is a checksum with a key: unlike a plain hash it proves not only that a file is unchanged, but also that it comes from someone who knows the same secret key. Only a holder of the key can reproduce the same value - which makes an HMAC suitable for confirming the authenticity and integrity of a file between two parties who agreed on a key beforehand.

You pick the underlying hash function. SHA-256 is today’s standard and the right choice when nothing else is required. SHA-384 and SHA-512 give longer values from the same family; SHA-1 and MD5 are considered outdated and should only be used to match older systems. The key is entered as text and used as UTF-8 bytes - exactly like the command-line tools, so the result compares 1:1 with the value from openssl.

The computation runs entirely locally in your browser via the native Web Crypto interface - nothing is uploaded, nothing is stored, and no foreign library is loaded from a CDN. That matters especially for an HMAC: both the file and the secret key stay on your device. The result appears as a text file in the format hex value followed by the file name, directly comparable with a value produced elsewhere.

Specifications

In 3 steps

1. Drop a file and enter a secret key.
2. Pick the hash method (default: SHA-256).
3. Read the HMAC and download it as a text file.

Limitations: An HMAC ensures authenticity and integrity but does not encrypt anything - the file content stays readable. Its security rests entirely on the key: it must stay secret and be agreed over a secure channel. SHA-1 and MD5 are only meant for matching legacy systems, not for new security requirements.

FAQ

Related tools

• Calculate a checksum
• Encrypt file
• Decode Base64